FDA Reissues Device Cybersecurity Guidance to Match New Quality Management Rule

The US Food and Drug Administration has reissued its final guidance on cybersecurity in medical devices, updating it to reflect the agency's new device quality rule. The guidance document, issued February 3, 2026, carries a new title, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions," and supersedes the version issued June 27, 2025, which referred to "Quality System Considerations."

The timing follows the device industry's switch to a new quality framework. According to the guidance, the final rule amending 21 CFR Part 820, now called the Quality Management System Regulation (QMSR), took effect on February 2, 2026, and incorporates by reference the 2016 edition of the international standard ISO 13485.

A conforming update, not new policy

The FDA described the change as a procedural one. "Revisions issued [were] under Level 2 guidance procedures (21 CFR 10.115(g)(4)), including revisions to align with the amendments to 21 CFR 820 (the Quality Management System Regulation (QMSR))," the agency said in the new guidance, as quoted by Regulatory Focus.

Regulatory Focus, the news service of the Regulatory Affairs Professionals Society, reported on February 4 that the update replaces references to the old Quality System Regulation with references to the QMSR and, more specifically, to ISO 13485. RAPS also reported that the FDA removed a section of the earlier text that cited the old design-control requirements at 21 CFR 820.30(c) and 820.30(d).

The revised text ties cybersecurity work to specific parts of the standard. "For example, 21 CFR 820.10(c) requires that for all classes of devices automated with software, a manufacturer must comply with the requirements in Design and Development, Clause 7.3 and its subclauses of ISO 13485," the guidance says. It adds that design and development validation includes validation of device software, and that Subclause 7.1 of ISO 13485 requires documented processes for risk management in product realization.

What the guidance covers

The guidance, issued jointly by the Center for Devices and Radiological Health and the Center for Biologics Evaluation and Research, sets out the FDA's recommendations on cybersecurity device design, labeling and the documentation it recommends be included in premarket submissions. It applies to premarket notification (510(k)) submissions, De Novo requests, premarket approval applications and supplements, product development protocols, investigational device exemptions, humanitarian device exemptions, and biologics license and investigational new drug submissions when they are sent to CDRH or CBER.

According to the document, its recommendations also apply to devices that do not need a premarket submission, such as 510(k)-exempt devices, and it is not limited to network-connected products. It also addresses section 524B of the Federal Food, Drug, and Cosmetic Act, which sets requirements for what the law calls "cyber devices," and the guidance includes recommendations on documenting plans and procedures and a software bill of materials to comply with that section.

The guidance has been revised several times. Its revision history lists a final version from September 2023, a draft reissued in March 2024 and the June 2025 final version that the new edition replaces. Like all FDA guidance, the document states that it does not establish legally enforceable responsibilities unless specific regulatory or statutory requirements are cited. The FDA's guidance page says comments can still be submitted at any time under docket number FDA-2021-D-1158.